Accepted linux-signed-amd64 4.19.67+2+deb10u2 (source) into proposed-updates->stable-new, proposed-updates
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 11 Nov 2019 00:30:56 +0000
Source: linux-signed-amd64
Binary: kernel-image-4.19.0-6-amd64-di nic-modules-4.19.0-6-amd64-di nic-wireless-modules-4.19.0-6-amd64-di nic-shared-modules-4.19.0-6-amd64-di serial-modules-4.19.0-6-amd64-di usb-serial-modules-4.19.0-6-amd64-di ppp-modules-4.19.0-6-amd64-di pata-modules-4.19.0-6-amd64-di cdrom-core-modules-4.19.0-6-amd64-di firewire-core-modules-4.19.0-6-amd64-di scsi-core-modules-4.19.0-6-amd64-di scsi-modules-4.19.0-6-amd64-di scsi-nic-modules-4.19.0-6-amd64-di loop-modules-4.19.0-6-amd64-di btrfs-modules-4.19.0-6-amd64-di ext4-modules-4.19.0-6-amd64-di isofs-modules-4.19.0-6-amd64-di jfs-modules-4.19.0-6-amd64-di xfs-modules-4.19.0-6-amd64-di fat-modules-4.19.0-6-amd64-di md-modules-4.19.0-6-amd64-di multipath-modules-4.19.0-6-amd64-di usb-modules-4.19.0-6-amd64-di usb-storage-modules-4.19.0-6-amd64-di pcmcia-storage-modules-4.19.0-6-amd64-di fb-modules-4.19.0-6-amd64-di input-modules-4.19.0-6-amd64-di event-modules-4.19.0-6-amd64-di mouse-modules-4.19.0-6-amd64-di
nic-pcmcia-modules-4.19.0-6-amd64-di pcmcia-modules-4.19.0-6-amd64-di nic-usb-modules-4.19.0-6-amd64-di sata-modules-4.19.0-6-amd64-di acpi-modules-4.19.0-6-amd64-di i2c-modules-4.19.0-6-amd64-di crc-modules-4.19.0-6-amd64-di crypto-modules-4.19.0-6-amd64-di crypto-dm-modules-4.19.0-6-amd64-di efi-modules-4.19.0-6-amd64-di ata-modules-4.19.0-6-amd64-di mmc-core-modules-4.19.0-6-amd64-di mmc-modules-4.19.0-6-amd64-di nbd-modules-4.19.0-6-amd64-di squashfs-modules-4.19.0-6-amd64-di speakup-modules-4.19.0-6-amd64-di uinput-modules-4.19.0-6-amd64-di sound-modules-4.19.0-6-amd64-di compress-modules-4.19.0-6-amd64-di udf-modules-4.19.0-6-amd64-di fuse-modules-4.19.0-6-amd64-di mtd-core-modules-4.19.0-6-amd64-di linux-image-4.19.0-6-amd64 linux-image-4.19.0-6-cloud-amd64
linux-image-4.19.0-6-rt-amd64
Architecture: source
Version: 4.19.67+2+deb10u2
Distribution: buster-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Ben Hutchings <ben@decadent.org.uk>
Description:
acpi-modules-4.19.0-6-amd64-di - ACPI support modules (udeb)
ata-modules-4.19.0-6-amd64-di - ATA disk modules (udeb)
btrfs-modules-4.19.0-6-amd64-di - BTRFS filesystem support (udeb)
cdrom-core-modules-4.19.0-6-amd64-di - CDROM support (udeb)
compress-modules-4.19.0-6-amd64-di - lzo modules (udeb)
crc-modules-4.19.0-6-amd64-di - CRC modules (udeb)
crypto-dm-modules-4.19.0-6-amd64-di - devicemapper crypto module (udeb)
crypto-modules-4.19.0-6-amd64-di - crypto modules (udeb)
efi-modules-4.19.0-6-amd64-di - EFI modules (udeb)
event-modules-4.19.0-6-amd64-di - Event support (udeb)
ext4-modules-4.19.0-6-amd64-di - ext2/ext3/ext4 filesystem support (udeb)
fat-modules-4.19.0-6-amd64-di - FAT filesystem support (udeb)
fb-modules-4.19.0-6-amd64-di - Frame buffer support (udeb)
firewire-core-modules-4.19.0-6-amd64-di - Core FireWire drivers (udeb)
fuse-modules-4.19.0-6-amd64-di - FUSE modules (udeb)
i2c-modules-4.19.0-6-amd64-di - i2c support modules (udeb)
input-modules-4.19.0-6-amd64-di - Input devices support (udeb)
isofs-modules-4.19.0-6-amd64-di - ISOFS filesystem support (udeb)
jfs-modules-4.19.0-6-amd64-di - JFS filesystem support (udeb)
kernel-image-4.19.0-6-amd64-di - Linux kernel image and core modules for the Debian installer (udeb)
linux-image-4.19.0-6-amd64 - ${unsigned:DescriptionShort} (signed)
linux-image-4.19.0-6-cloud-amd64 - ${unsigned:DescriptionShort} (signed)
linux-image-4.19.0-6-rt-amd64 - ${unsigned:DescriptionShort} (signed)
loop-modules-4.19.0-6-amd64-di - Loopback filesystem support (udeb)
md-modules-4.19.0-6-amd64-di - RAID and LVM support (udeb)
mmc-core-modules-4.19.0-6-amd64-di - MMC/SD/SDIO core modules (udeb)
mmc-modules-4.19.0-6-amd64-di - MMC/SD card modules (udeb)
mouse-modules-4.19.0-6-amd64-di - Mouse support (udeb)
mtd-core-modules-4.19.0-6-amd64-di - MTD core (udeb)
multipath-modules-4.19.0-6-amd64-di - Multipath support (udeb)
nbd-modules-4.19.0-6-amd64-di - Network Block Device modules (udeb)
nic-modules-4.19.0-6-amd64-di - NIC drivers (udeb)
nic-pcmcia-modules-4.19.0-6-amd64-di - Common PCMCIA NIC drivers (udeb)
nic-shared-modules-4.19.0-6-amd64-di - Shared NIC drivers (udeb)
nic-usb-modules-4.19.0-6-amd64-di - USB NIC drivers (udeb)
nic-wireless-modules-4.19.0-6-amd64-di - Wireless NIC drivers (udeb)
pata-modules-4.19.0-6-amd64-di - PATA drivers (udeb)
pcmcia-modules-4.19.0-6-amd64-di - Common PCMCIA drivers (udeb)
pcmcia-storage-modules-4.19.0-6-amd64-di - PCMCIA storage drivers (udeb)
ppp-modules-4.19.0-6-amd64-di - PPP drivers (udeb)
sata-modules-4.19.0-6-amd64-di - SATA drivers (udeb)
scsi-core-modules-4.19.0-6-amd64-di - Core SCSI subsystem (udeb)
scsi-modules-4.19.0-6-amd64-di - SCSI drivers (udeb)
scsi-nic-modules-4.19.0-6-amd64-di - SCSI drivers for converged NICs (udeb)
serial-modules-4.19.0-6-amd64-di - Serial drivers (udeb)
sound-modules-4.19.0-6-amd64-di - sound support (udeb)
speakup-modules-4.19.0-6-amd64-di - speakup modules (udeb)
squashfs-modules-4.19.0-6-amd64-di - squashfs modules (udeb)
udf-modules-4.19.0-6-amd64-di - UDF modules (udeb)
uinput-modules-4.19.0-6-amd64-di - uinput support (udeb)
usb-modules-4.19.0-6-amd64-di - USB support (udeb)
usb-serial-modules-4.19.0-6-amd64-di - USB serial drivers (udeb)
usb-storage-modules-4.19.0-6-amd64-di - USB storage support (udeb)
xfs-modules-4.19.0-6-amd64-di - XFS filesystem support (udeb)
Changes:
linux-signed-amd64 (4.19.67+2+deb10u2) buster-security; urgency=high
.
* Sign kernel from linux 4.19.67-2+deb10u2
.
* [x86] Add mitigation for TSX Asynchronous Abort (CVE-2019-11135):
- KVM: x86: use Intel speculation bugs and features as derived in generic
x86 code
- x86/msr: Add the IA32_TSX_CTRL MSR
- x86/cpu: Add a helper function x86_read_arch_cap_msr()
- x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
- x86/speculation/taa: Add mitigation for TSX Async Abort
- x86/speculation/taa: Add sysfs reporting for TSX Async Abort
- kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
- x86/tsx: Add "auto" option to the tsx= cmdline parameter
- x86/speculation/taa: Add documentation for TSX Async Abort
- x86/tsx: Add config options to set tsx=on|off|auto
- x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs
TSX is now disabled by default; see
Documentation/admin-guide/hw-vuln/tsx_async_abort.rst
* [x86] KVM: Add mitigation for Machine Check Error on Page Size Change
(aka iTLB multi-hit, CVE-2018-12207):
- kvm: Convert kvm_lock to a mutex
- kvm: x86: Do not release the page inside mmu_set_spte()
- KVM: x86: make FNAME(fetch) and __direct_map more similar
- KVM: x86: remove now unneeded hugepage gfn adjustment
- KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON
- KVM: x86: add tracepoints around __direct_map and FNAME(fetch)
- kvm: x86, powerpc: do not allow clearing largepages debugfs entry
- KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active
- x86/bugs: Add ITLB_MULTIHIT bug infrastructure
- cpu/speculation: Uninline and export CPU mitigations helpers
- kvm: mmu: ITLB_MULTIHIT mitigation
- kvm: Add helper function for creating VM worker threads
- kvm: x86: mmu: Recovery of shattered NX large pages
- Documentation: Add ITLB_MULTIHIT documentation
* [x86] i915: Mitigate local privilege escalation on gen9 (CVE-2019-0155):
- drm/i915: Rename gen7 cmdparser tables
- drm/i915: Disable Secure Batches for gen6+
- drm/i915: Remove Master tables from cmdparser
- drm/i915: Add support for mandatory cmdparsing
- drm/i915: Support ro ppgtt mapped cmdparser shadow buffers
- drm/i915: Allow parsing of unsized batches
- drm/i915: Add gen9 BCS cmdparsing
- drm/i915/cmdparser: Use explicit goto for error paths
- drm/i915/cmdparser: Add support for backward jumps
- drm/i915/cmdparser: Ignore Length operands during command matching
- drm/i915/cmdparser: Fix jump whitelist clearing
* [x86] i915: Mitigate local denial-of-service on gen8/gen9 (CVE-2019-0154):
- drm/i915: Lower RM timeout to avoid DSI hard hangs
- drm/i915/gen8+: Add RC6 CTX corruption WA
Checksums-Sha1:
37048c7b90a4a98247d4a4d22dfd695f7ba69cc3 7873 linux-signed-amd64_4.19.67+2+deb10u2.dsc
a8ab91c19ee306ac9d0159ace8eb8a7efc68fed3 2452344 linux-signed-amd64_4.19.67+2+deb10u2.tar.xz
Checksums-Sha256:
8650aec2d1e44e25f1ddcb61423d9264d2300586242acf293d719f0205e4e051 7873 linux-signed-amd64_4.19.67+2+deb10u2.dsc
fde2a1d4b2ee203fa970e75607c614e29db46b575ce0fd39a348b545fbb59186 2452344 linux-signed-amd64_4.19.67+2+deb10u2.tar.xz
Files:
3f47f1a617c490b02f031080f48feb84 7873 kernel optional linux-signed-amd64_4.19.67+2+deb10u2.dsc
affddb2b1c1cca7018244d05ccdf8dc7 2452344 kernel optional linux-signed-amd64_4.19.67+2+deb10u2.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE8nXL3e4u3Tgu6Vp6qgZoiu+K+NUFAl3JuBEACgkQqgZoiu+K
+NUW+A//XYEeTRL2FFxlD5u5vExY4QF0vM0gdwtv1RWsJIcN7iQI6Qgm+n1PaWl/
C7p3HSPa0yrxVe8Cn/TAHUqoKjGuKUgSGAbBI53cStnhiOLi6hw+pR++j2az2lnB
pwXIK/R15SQ554K7L1Noxoiw+xukIy/A92RhRFgXwyzi8NCkwLA0uD/r3LtBEB8L
WdWTxM5vNEtTx3zrKdTZpWADkYzMgV3QVW+eS0xUomYItAZ3vctNg3c+ONtakGLK
Dc8TY3LaoPhbR9rF+T50iDed4o83q6ghZtILxpQsGxFS35Rdihoa+DC1Np2IZML0
uuZQGVeY4wRwAJS4A/fOBJZtpCzoNiOBhfpJ32GxDVrLTlhRq22Ax0RbOt1MO013
1e4nCby0PoVkI+eUg41vQ20D4UlzGhDhDH6ndUL6qNoeUfIpHkAzXuHuH4NpHJ3d
5mngLUNHY9djVN68G3dNSW9e0AcucAyuWoDaezgEfmlN19atRFKWoxjRRrj8Xmdx
flnG4ii0WeiaIAV4ui37PA1oxbhA2Yc4styrMrD47P29GwHXdykhr84qkyFl2r4C
WXd3eivP258hb0+AtK1MsovDb8BOk16hLEqsom8f5V+Nfn1ghCoAawrdsYyA+3qy
QauXU4ou+GmF+pryX66pB73FJ+q0EvDAzfArn+njU9MFBDGgPYs=
=vSDY
-----END PGP SIGNATURE-----